IBM C1000-162 study plan
IBM C1000-162 · Give each week a clear focus.
8 weeks · About 6 hours per week
Offense Analysis
Map the offense-analysis workflow from raw event ingestion to offense closure, naming each stage and its inputs and outputs.
Configure offense generation settings (coalescing, sensitivity, thresholds) in a lab QRadar deployment and observe how each setting changes offense volume.
Explain how rules, building blocks, and custom properties feed offense creation, using one worked example end to end.
Identify the offense fields (magnitude, credibility, severity, relevance) and describe what drives each score.
Your checkpoint
A one-page offense lifecycle diagram with the score-contribution table and three lab observations showing how changing coalescing or sensitivity altered offense counts.
Offense Analysis
Triage ten sample offenses by assigning magnitude, credibility, and severity adjustments and justify each change.
Tune an over-noisy rule using offense thresholds and time windows, then verify the reduction in the lab.
Analyze offense details for contributing events, flows, and network hierarchy context to separate true positives from benign activity.
Document the escalation path from offense to incident, including what evidence to attach.
Your checkpoint
A triage log of ten offenses with before/after scores, a tuning change note, and a written true-positive vs. false-positive decision for each.
Rules and Building Block Design
Decompose five built-in rules into their test logic, response, and referenced building blocks.
Author three custom rules that use at least one building block and one reference set each.
Build two building blocks that group related tests and reuse them across multiple rules.
Create and populate a reference set, then reference it from a rule to filter known-good assets.
Your checkpoint
A rule pack of three working custom rules with two building blocks and one reference set, plus a short design note explaining reuse and false-positive controls.
Threat Hunting
Formulate five hypothesis-driven hunts from MITRE ATT&CK techniques relevant to your environment.
Translate each hypothesis into AQL queries using filters, grouping, and time bucketing.
Validate hunt results against baselines to distinguish anomalies from normal activity.
Convert one validated hunt finding into a detection rule.
Your checkpoint
A hunt journal with five hypotheses, their AQL queries, baseline comparisons, and one rule promoted from a confirmed finding.
Threat Hunting
Apply the MITRE ATT&CK coverage map to identify gaps in current detections for two tactics.
Hunt for lateral movement and credential-access patterns using flow and event data together.
Use network hierarchy and asset data to scope hunt results to critical segments.
Write a hunt report that states confidence level and recommended next actions.
Your checkpoint
A coverage-gap table for two ATT&CK tactics with at least three proposed detections and a full hunt report for one lateral-movement scenario.
Searching and Reporting
Write AQL searches that use aggregation, subqueries, and time-series functions to answer five analyst questions.
Build three scheduled reports with appropriate time ranges and output formats.
Create a saved search that other analysts can reuse, with documented parameters.
Export and validate report output for a compliance-style request.
Your checkpoint
A search and report library of five AQL queries, three scheduled reports, and one reusable saved search with parameter documentation.
Dashboard Management
Design a dashboard layout that answers three stakeholder questions with the fewest widgets.
Build widgets using saved searches, then configure drill-downs to offense and event detail.
Apply filters and time-range controls so one dashboard serves multiple audiences.
Review dashboard performance and adjust queries to reduce load.
Your checkpoint
A working dashboard with at least four widgets, two drill-downs, and a performance note comparing query run times before and after optimization.
Offense Analysis & Threat Hunting
Re-run the week 1 offense lifecycle exercise and reconcile any differences in understanding.
Complete a timed mixed-domain practice set and review every missed item to its root cause.
Consolidate weak areas into a final one-page cheat sheet of key settings, AQL patterns, and triage steps.
Verify readiness by scoring at least 80% on the practice set before scheduling the exam.
Your checkpoint
A final readiness report with practice-set score, a root-cause list for missed items, and a one-page cheat sheet covering all five domains.
Milestones
Week 2: Can explain offense scoring and complete a triage of ten offenses with justified score adjustments.
Week 4: Has authored three working custom rules with reusable building blocks and completed five hypothesis-driven hunts.
Week 6: Can write aggregation and subquery AQL from memory and has three scheduled reports running.
Week 8: Scores at least 80% on a timed mixed-domain practice set and has a completed cheat sheet and readiness report.